Issue #10451: memoryview objects could allow to mutate a readable buffer.

Initial patch by Ross Lagerwall.

4 files changed, 18 insertions, 4 deletions

diff --git a/Lib/test/test_getargs2.py b/Lib/test/test_getargs2.py
index e8f4fc2..3d9c06a 100644
--- a/Lib/test/test_getargs2.py
+++ b/Lib/test/test_getargs2.py
@@ -381,8 +381,10 @@ class Bytes_TestCase(unittest.TestCase):
         self.assertRaises(TypeError, getargs_w_star, 'abc\xe9')
         self.assertRaises(TypeError, getargs_w_star, b'bytes')
         self.assertRaises(TypeError, getargs_w_star, b'nul:\0')
+        self.assertRaises(TypeError, getargs_w_star, memoryview(b'bytes'))
         self.assertEqual(getargs_w_star(bytearray(b'bytearray')), b'[ytearra]')
-        self.assertEqual(getargs_w_star(memoryview(b'memoryview')), b'[emoryvie]')
+        self.assertEqual(getargs_w_star(memoryview(bytearray(b'memoryview'))),
+                         b'[emoryvie]')
         self.assertRaises(TypeError, getargs_w_star, None)
 
 
diff --git a/Lib/test/test_memoryview.py b/Lib/test/test_memoryview.py
index 9a52fe90..0bfddd9 100644
--- a/Lib/test/test_memoryview.py
+++ b/Lib/test/test_memoryview.py
@@ -9,6 +9,7 @@ import sys
 import gc
 import weakref
 import array
+import io
 
 
 class AbstractMemoryTests:
@@ -271,6 +272,17 @@ class AbstractMemoryTests:
             m.release()
             self._check_released(m, tp)
 
+    def test_writable_readonly(self):
+        # Issue #10451: memoryview incorrectly exposes a readonly
+        # buffer as writable causing a segfault if using mmap
+        tp = self.ro_type
+        if tp is None:
+            return
+        b = tp(self._source)
+        m = self._view(b)
+        i = io.BytesIO(b'ZZZZ')
+        self.assertRaises(TypeError, i.readinto, m)
+
 # Variations on source objects for the buffer: bytes-like objects, then arrays
 # with itemsize > 1.
 # NOTE: support for multi-dimensional objects is unimplemented.
diff --git a/Misc/NEWS b/Misc/NEWS
index 071ad42..1bc3b2f 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -10,6 +10,9 @@ What's New in Python 3.2 Release Candidate 2?
 Core and Builtins
 -----------------
 
+- Issue #10451: memoryview objects could allow to mutate a readable buffer.
+  Initial patch by Ross Lagerwall.
+
 Library
 -------
 
diff --git a/Objects/memoryobject.c b/Objects/memoryobject.c
index a05b97b..7782076 100644
--- a/Objects/memoryobject.c
+++ b/Objects/memoryobject.c
@@ -52,9 +52,6 @@ memory_getbuf(PyMemoryViewObject *self, Py_buffer *view, int flags)
 {
     int res = 0;
     CHECK_RELEASED_INT(self);
-    /* XXX for whatever reason fixing the flags seems necessary */
-    if (self->view.readonly)
-        flags &= ~PyBUF_WRITABLE;
     if (self->view.obj != NULL)
         res = PyObject_GetBuffer(self->view.obj, view, flags);
     if (view)